OT Risk Without The Guesswork - Episode 11 (Andrew Ginter & Pedro Kertzman)

A lot of cybersecurity advice falls apart the moment the “asset” is a turbine, a boiler, a rail system, or a water plant. We sit down with Andrew Ginter, VP of Industrial Security at Waterfall Security Solutions and author of multiple OT cybersecurity books, to get practical about what actually matters in operational technology security: understanding how attacks work, where they enter, and what they can do in the physical world.We unpack why many OT programs struggle when they inherit IT-first language and assumptions. In critical infrastructure, the priorities are often safety, reliability, and efficiency not just protecting information. Andrew explains the shift from treating information as the asset to treating attack information as the threat, and why mapping “consequence boundaries” and information flows can reveal the most important attack vectors. We also talk about pivoting attacks, residual cyber risk, and how to think like an engineer when the worst credible consequence is simply unacceptable.For CTI teams and security leaders trying to brief executives, we explore a better way to communicate risk than likelihood times impact. High-end adversaries are not random, so Andrew advocates framing board conversations around credibility and reasonableness: what is reasonable to believe about intent, capability, and opportunity, and what defenses are reasonable given legal and business obligations. We close with a hard look at the next step change AI-driven zero-days and why cyber-informed engineering and resilience, including deterministic safeguards, will matter more than ever.Subscribe for more practical CTI and OT security conversations, share this with a teammate who briefs leadership, and leave a review to help others find the show.https://waterfall-security.com/ot-insights-center/ot-cybersecurity-insights-center/engineering-grade-ot-security-a-managers-guide/Send us Fan MailSupport the showThanks for tuning in! If you found this episode valuable, don’t forget to subscribe, share, and leave a review. Got thoughts or questions? Connect with us on our LinkedIn Group: Cyber Threat Intelligence Podcast—we’d love to hear from you. If you know anyone with CTI expertise that would like to be interviewed in the show, just let us know. Until next time, stay sharp and stay secure!